Question [SOLVED] ntoskrnl.exe+3fdf30 + other BSODs = out of ideas

[NaranJust]

Hey everyone, ChatGPT helped me make this as concise as possible

So, I recently upgraded my PC and have been getting repeated BSODs. Hoping someone can help me figure out what’s going on.
________________________________________
System specs:
MB: MSI Z790 Tomahawk WiFi (latest BIOS via USB flashback)
CPU: Intel i5-14600KF + Thermalright Phantom Spirit 120 SE
GPU: Gigabyte RTX 4070
RAM: 32GB Kingston FURY DDR5 6000MHz CL30 (XMP)
Storage: WD 2TB SN850X M.2 + 2TB WD Black HDD
PSU: Seasonic Focus GX 750W Gold (used for 5 years)
OS: Windows 10 (clean installs)
XMP Profile 1 enabled, CPU undervolt -0.150V (temperatures dropped from 100 to 75 at max load)
_____________________________________
I'm getting frequent BSODs, even after multiple Windows reinstalls. Some key incidents:
Initial BSOD: IRQL_NOT_LESS_OR_EQUAL after Chrome crash, and it led to a corrupted Chrome profile
USB devices briefly disconnected before this crash
Event Viewer: Smart Card, DistributedCOM warnings, and DeviceSetupManager error (Event ID 131) - wrote this just in case

Next BSODs:
Same error while cleaning Chrome cookies (ntoskrnl.exe+22434a, 0x0000000A)
Then, another BSOD related to ACPI.sys
After that, while typing in Chrome → BSOD: KERNEL_MODE_HEAP_CORRUPTION
After reinstalling Win10, launched Chrome installer → same BSOD

SFC scan: Corrupted WindowsBase.dll and KB5056578 even after ISO repair
Next, installed .NET 4.8.1 and ran chkdsk, which triggered endless Automatic Repair loop and another Windows reinstall

Latest Windows install (WITHOUT XMP + UNDERVOLT SET TO -0.130, LLC LEVEL 3):
Installed drivers offline before connecting to internet
Windows Update installed Razer Synapse (for my mouse) + "Intel - Net" driver (don't know what this is)
Then, during an image backup to external USB 3.0 HDD (connected to front panel), all USB devices disconnected and the process failed
Tried it again → BSOD: KERNEL_MODE_HEAP_CORRUPTION (ntoskrnl.exe+3fdf30)
________________________________________
What I’ve tried:
Switched to XMP Profile 2, then fully disabled XMP
CPU undervolt adjusted to -0.130V, LLC Level 3
memtest86 with XMP Profile 2 (2 full passes) – no errors
Windows Memory Test – no issues

Stability tests:
Prime95, FurMark, Intel XTU (from -0.150 to -0.130) – all passed
Temps good: CPU max ~79°C, GPU ~60°C, idle around 51°C
________________________________________
What works well:
System is stable during long gaming sessions (Oblivion Remastered, KCD2)
Plays YouTube overnight with no issues
No Chrome glitches anymore, but it was running in background when I got the last BSOD
Overall, PC feels fast and snappy
________________________________________

I've tried everything I can think of—disabling unnecessary services, testing memory, stable drivers, no Fast Startup, SSD/HDD maintenance, power cycling, etc.
What should I try next? What could be the main cause?

 

[Lutfij]

You could pass on the .dmp files for us to look through. For the sake of relevance, please include the BIOS version for your motherboard.

As for your OS install, did you recreate your bootable USB installer to rule out a corrupt installer? With your OS install, did you do so removing all drives except for the one you wished to install the OS onto, removing all partitions and then installing the OS in offline mode?

 

[NaranJust]

You could pass on the .dmp files for us to look through. For the sake of relevance, please include the BIOS version for your motherboard.

As for your OS install, did you recreate your bootable USB installer to rule out a corrupt installer? With your OS install, did you do so removing all drives except for the one you wished to install the OS onto, removing all partitions and then installing the OS in offline mode?

Of course, here is the dump file from Windows/minidump: https://we.tl/t-KfdvQGLTqt

BIOS is the latest one - 7D91vHG (released on April 22 this year)

Yes, I recreated my OS install, even on another computer and an older version of Rufus.
And yes, I only had my SSD in when I installed Windows for the first time.
For other installation, I also had my HDD connected.

EDIT: All installations were offline, and all partitions on my SSD were deleted and formatted every time.

 

[johnbl]

bugcheck shows kernel heap corruption
starting from a call from the app
RazerAppEngine.exe

the error code was 12=
0x12 : The heap detected invalid internal state during the current operation. This is usually the result of a buffer overflow.

you would update the device firmware, then update the app and the razer driver it is talking to.
system was up 1 hr 35 mins before bugcheck.
i see two razer drivers installed:
RzCommon.sys Mon Sep 25 20:29:57 2023
RzDev_0099.sys Wed Aug 3 03:09:20 2022

debugger does not like many of your windows files, checksums not matching.

you have this running
C:\Program Files (x86)\MSI Afterburner\RTCore64.sys Thu Jun 18 04:55:42 2020
(this driver is often exploited for malware access)

this could be a razer problem, (about 60% chance)
or it could be another driver that corrupted the razer driver's data) I would update the device firmware, and software. remove the rtcore64.sys if you do not use it or see if you can update it.

I would then turn of windows virtual memory, reboot and turn it back on to delete the pagefile.sys and make a new one.
after that I would start cmd.exe as an admin and run
dism.exe /online /cleanup-image /restorehealth
and see if it will fix the modified windows files.
(assuming the debugger is correctly finding the microsoft symbols)

 

[NaranJust]

bugcheck shows kernel heap corruption
starting from a call from the app
RazerAppEngine.exe

the error code was 12=
0x12 : The heap detected invalid internal state during the current operation. This is usually the result of a buffer overflow.

you would update the device firmware, then update the app and the razer driver it is talking to.
system was up 1 hr 35 mins before bugcheck.
i see two razer drivers installed:
RzCommon.sys Mon Sep 25 20:29:57 2023
RzDev_0099.sys Wed Aug 3 03:09:20 2022

Does this mean my Razer software is causing the crashes? It is possible, as Synapse tends to be buggy, and Windows Updates installed it, as well as a HID device. I've deleted Synapse through RevoUninstaller. Should I also do something in the device manager? Please advise.

EDIT: Also, whenever I restart my computer, I can briefly see that RazerAppEngine.exe is preventing it from restarting. The restart screen lingers for 15 seconds, in worst cases 30.

 

[johnbl]

Does this mean my Razer software is causing the crashes? It is possible, as Synapse tends to be buggy, and Windows Updates installed it, as well as a HID device. I've deleted Synapse through RevoUninstaller. Should I also do something in the device manager? Please advise.

EDIT: Also, whenever I restart my computer, I can briefly see that RazerAppEngine.exe is preventing it from restarting. The restart screen lingers for 15 seconds, in worst cases 30.

most likely a razer problem, update the device firmware if you can, then update the drivers and the app running as a service or from windows startup.

delete the pagefile.sys since it might have already saved corruptions to disk.

I have seen razer driver assume that a user mode file handle and a kernel mode file handle are the same but they are not.
the look the same and act the same until windows memory management moves data structures in kernel memory.

debugger said some of your windows drivers are modified but not all of them. ie
nt kernel showed no error but others had bad checksums.

 

[NaranJust]

All right, I've updated MSI Afterburner (Beta) and it's now using a newer version of RTCore64.sys.
I've deleted Synapse, and those two pesky files (had to use IOBitLocker), reinstalled Synapse, the firmware is already the latest.

However, I see that RzDev_0099.sys and RzCommon.sys are back in their original locations, but with a bit more recent date.
BEFORE: RzCommon.sys Sep 25 2023 ||| AFTER: RzCommon.sys Sep 26 2023
BEFORE: RzDev_0099.sys Wed Aug 3 03:09:20 2022 ||| AFTER: RzDev_0099.sys Aug 18 2022

Could these be updated files or did I do something wrong? Should I just ditch this mouse?

I also refreshed virtual memory, it was ~5000 MB before, now it's 32 GB (like my RAM).
I haven't deleted pagefile.sys, just did it through cmd. I'll try this next while I wait for your answer.

 

[johnbl]

with the razer drivers it is strange the date changed so little. but, if the device was removed while the device was plugged in then maybe your removed it, plug and play detected the change and reinstalled the software a few seconds after the remove..

you might start cmd.exe as an an admin and run
net.exe /stop "plug and play"

then remove the device/ drivers and install the new updates and then go back to cmd.exe
and run
net.exe /start "plug and play"

you could also download and run driver store explorer and delete the driver package so it does not get reinstalled.

https://github.com/lostindark/DriverStoreExplorer/releases/tag/v0.12.88

 

[johnbl]

you might consider: google how to make windows delete the pagefile.sys on system reboot. make the registry changes and reboot, keep this setting until you resolve this problem.
(just so corruptions are not saved to disk to cause bugchecks later)

since it was a kernel heap corruption, you can also run verifier.exe tool to help find the corruption. it will make the system crash at the time of the first corruption rather than crashing later when the corrupted data is used by some driver.

 

[NaranJust]

It keeps returning those files whenever I plug it back in, no matter what I do. So now, I just plugged it back in so it acts like a regular mouse, no Synapse, no quirky files. Now it's time to do some testing and see if I can recreate BSODs.

I'll just handle pagefile.sys first. Thank you so much for your help! If BSODs continue, I will be back.

 

[johnbl]

It keeps returning those files whenever I plug it back in, no matter what I do. So now, I just plugged it back in so it acts like a regular mouse, no Synapse, no quirky files. Now it's time to do some testing and see if I can recreate BSODs.

I'll just handle pagefile.sys first. Thank you so much for your help! If BSODs continue, I will be back.

ya, when you plug in the mouse, windows plug and play detects it and looks on your local drive for the proper files. if it finds them in the driver store it installs them. if it does not find the proper files then it goes to the internet and downloads versions from microsoft.
if I look here:https://catalog.update.microsoft.com/Search.aspx?q=razer
it looks like microsoft has a version 3 of the software dated
10/23/2023 (date on the installer, not always the same as the driver date. I would expect razer to have more up to date drivers and firmware updates for the mouse.)

 

[NaranJust]

I would expect so too, but I see people are complaining about it. Eh, what can you do
Now I finished everything you asked me to, and I'm going to try creating an image to an external drive to see if I can replicate a BSOD. Hopefully not. Wish me luck!

 

[johnbl]

I would expect so too, but I see people are complaining about it. Eh, what can you do
Now I finished everything you asked me to, and I'm going to try creating an image to an external drive to see if I can replicate a BSOD. Hopefully not. Wish me luck!

change the memory dump to kernel and the proper debug info will be saved in memory.dmp and can be read by the debugger to see what is going on. (maybe)

 

[NaranJust]

I'll google it later. Now that I have done everything you wrote, the Chrome issues came back and it kept signing me out of websites... HOWEVER!

I tried making a backup image again... No crashes, no BSODs, no USB unplugs!!!
Then I restarted my PC, activated XMP Profile 1 again, tried making the backup image... Again successful!
I launched Chrome, and by some MIRACLE it stayed logged in in all websites!

Thank you so much, I cannot express how much I am grateful after investing so much money and hard work, I've been handling these issues for A WEEK now, I barely even slept. Please man, can I make some donations to you, I cannot express enough gratituded, I would literally cry out of happiness right now if I wasn't so exhausted 😀

 

[johnbl]

I'll google it later. Now that I have done everything you wrote, the Chrome issues came back and it kept signing me out of websites... HOWEVER!

I tried making a backup image again... No crashes, no BSODs, no USB unplugs!!!
Then I restarted my PC, activated XMP Profile 1 again, tried making the backup image... Again successful!
I launched Chrome, and by some MIRACLE it stayed logged in in all websites!

Thank you so much, I cannot express how much I am grateful after investing so much money and hard work, I've been handling these issues for A WEEK now, I barely even slept. Please man, can I make some donations to you, I cannot express enough gratituded, I would literally cry out of happiness right now if I wasn't so exhausted 😀

I am just glad you were able to get your machine up and running.
no need for a donation, I just look at memory dumps as little puzzles to work on while my wife watches tv. It gives me something to do and helps me remember the old debugger commands

 

[NaranJust]

Thank you once again, really!
I grabbed a week of vacation to see if I could fix everything, and you just made my holiday perfect!

Chrome keeps misbehaving here and there, deleting some cookies and sessions, but I'll just switch to another browser if it keeps doing so, as everything else works PERFECTLY!